API

Overview

• Base URL: https://www.openadvisories.org — HTTPS only.
• Responses are UTF-8 JSON (pretty-printed). Feeds are Atom 1.0.
• CORS is open (Access-Control-Allow-Origin: *) on JSON endpoints, so they work from a browser too.
• Data is refreshed hourly; results may be cached for up to 15 minutes.
• Every field that is a URL points back to the human-readable page on this site.

Check a package version

GET/api/check/{ecosystem}/{package}/{version}

Returns every known vulnerability and malicious-package report that affects this exact version, plus the fixed version of each.

curl -s https://www.openadvisories.org/api/check/npm/lodash/4.17.20

{
  "ecosystem": "npm",
  "release": null,
  "package": "lodash",
  "version": "4.17.20",
  "known_package": true,
  "vulnerable": true,
  "malicious": [],
  "vulnerabilities": [
    {
      "id": "CVE-2021-23337",
      "severity": "high",
      "cvss": 7.2,
      "exploited": false,
      "epss": 0.21333,
      "fixed_in": "4.17.21",
      "title": "Command Injection",
      "url": "https://www.openadvisories.org/vuln/CVE-2021-23337"
    }
  ],
  …
}

• vulnerable is true when any vulnerability or malware report matches.
• known_package is false when there is no record for this package at all — check the spelling.
• Ecosystems: npm, packagist, maven, pypi, go, crates-io, nuget, rubygems, hex, swifturl, github-actions, hackage, pub.
• Write the package name as the ecosystem does: Maven group:artifact, Go module paths with slashes (golang.org/x/net), scoped npm packages with @ (@babel/core). Characters such as + : @ ~ can be sent as-is.

Linux distributions

GET/api/check/{distro}/{release}/{package}/{version}

Distributions backport fixes, so the release is required and the version must be the full package version as reported by the package manager (including epoch and revision).

curl -s https://www.openadvisories.org/api/check/debian/12/openssl/3.0.11-1~deb12u2
curl -s https://www.openadvisories.org/api/check/ubuntu/22-04-lts/openssh/1:8.9p1-3ubuntu0.6
curl -s https://www.openadvisories.org/api/check/red-hat/rhel-9/openssl/1:3.0.7-24.el9
curl -s https://www.openadvisories.org/api/check/suse/sles-15-sp6/openssl-3/3.1.4-150600.5.7.1

The response has the same shape as above, with release set to the release label (for example "RHEL 9") and an extra advisories list of the distribution advisories that ship a fix.

The full list of releases is in the selector on the version check page; the URL it produces is the API path without /api.

Scan a server

POST/api/scan/server[?distro={distro}&release={release}][&format=text]

Send the list of installed packages as the request body. When it includes /etc/os-release (as the command below does), the distribution and release are detected; otherwise pass distro and release with the slugs from the table above. Max 5 MB and 10,000 packages; nothing is stored.

{ cat /etc/os-release; if command -v dpkg-query >/dev/null; then dpkg-query -W -f='${db:Status-Abbrev}${source:Package} ${source:Version}\n'; elif command -v rpm >/dev/null; then rpm -qa --qf '%{NAME} %{EPOCHNUM}:%{VERSION}-%{RELEASE}\n'; elif command -v apk >/dev/null; then apk list -I; fi; } \
  | curl -s --data-binary @- "https://www.openadvisories.org/api/scan/server"

{
  "distro": "red-hat",
  "release": "rhel-9",
  "release_label": "Red Hat RHEL 9",
  "detected": true,
  "summary": { "packages": 642, "vulnerable_packages": 5, "vulnerabilities": 152, "exploited": 2, "by_severity": { … } },
  "vulnerable": true,
  "warnings": [],
  "packages": [
    {
      "name": "openssl",
      "version": "1:3.0.7-24.el9",
      "epoch_assumed": false,
      "recommended_version": "1:3.5.8-2.el9_8",
      "unfixed": 0,
      "advisories": [ { "ref": "RHSA-2026:19218", "severity": "high", "fixed_in": "1:3.5.5-2.el9_8", "url": "https://www.openadvisories.org/advisory/RHSA-2026%3A19218" } ],
      "vulnerabilities": [ { "id": "CVE-2024-5535", "severity": "critical", "exploited": false, "fixed_in": "1:3.2.2-6.el9_5", … } ]
    }
  ]
}

• Accepted input: dpkg-query with source names (recommended for Debian/Ubuntu), rpm -qa --qf '%{NAME} %{EPOCHNUM}:%{VERSION}-%{RELEASE}\n', apk list -I, and — with a warning — plain dpkg -l, rpm -qa and apk info -v.
• format=text returns a plain-text table for terminals and cron mails.
• Only packages with findings are listed; summary.packages is the number checked.

Scan a lockfile

POST/api/scan?filename={lockfile name}

Send the file as the raw request body (or as a multipart field named lockfile). The type is detected from filename or the content; force it with type= if needed. Max 5 MB and 5,000 packages. The file is processed in memory and never stored.

curl -s --data-binary @package-lock.json "https://www.openadvisories.org/api/scan?filename=package-lock.json"
curl -s -F lockfile=@composer.lock https://www.openadvisories.org/api/scan

{
  "type": "package-lock.json",
  "ecosystem": "npm",
  "summary": {
    "packages": 412,
    "vulnerable_packages": 3,
    "malicious_packages": 0,
    "vulnerabilities": 7,
    "exploited": 0,
    "by_severity": { "critical": 0, "high": 2, "medium": 4, "low": 1, "unscored": 0 }
  },
  "vulnerable": true,
  "packages": [
    {
      "name": "lodash",
      "version": "4.17.20",
      "malicious": [],
      "recommended_version": "4.18.0",
      "vulnerabilities": [ { "id": "CVE-2021-23337", "severity": "high", "fixed_in": "4.17.21", … } ]
    }
  ]
}

Only affected packages are listed. recommended_version is the smallest version that fixes all of them, or null when at least one has no fix yet. Supported types: package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, composer.lock, Gemfile.lock, go.mod, Cargo.lock, packages.lock.json, gradle.lockfile.

Vulnerability record

GET/api/vuln/{id}

The full merged record for a CVE. GHSA and EUVD identifiers are accepted and resolve to the CVE they alias.

curl -s https://www.openadvisories.org/api/vuln/CVE-2021-44228 | jq '{severity, cvss: .cvss.score, exploited, epss: .epss.probability}'

{
  "id": "CVE-2021-44228",
  "aliases": ["EUVD-2021-34768", "GHSA-jfh8-c2jp-5v3q"],
  "title": "Apache Log4j2 JNDI features do not protect against …",
  "published": "2021-12-10T00:00:00+00:00",
  "severity": "critical",
  "cvss": { "score": 10, "version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" },
  "scores": [ … every CNA / ADP / EUVD score … ],
  "epss": { "probability": 0.99999, "percentile": 1 },
  "exploited": true,
  "kev": { "added": "2021-12-10", "due": "2021-12-24", "ransomware": true },
  "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data" } ],
  "tags": [ { "type": "vendor", "name": "Apache Software Foundation", "slug": "apache-software-foundation" }, … ],
  "packages": [ { "ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "affected": ">= 2.0-beta9, < 2.3.1", "fixed": "2.3.1", … } ],
  "advisories": [ { "id": "RHSA-2021:5094", "source": "redhat", … } ],
  "references": [ … ],
  "url": "https://www.openadvisories.org/vuln/CVE-2021-44228"
}

Atom feeds

Every list on the site has a feed: append /feed.xml to its URL. Filters are part of the path, so a feed can be as narrow as you like.

Feed readers find the feed automatically on every list page. Each feed returns the latest 40 entries.

Errors & limits

• 400 — the request could not be understood (for example an unrecognised lockfile); the JSON body has an error message.
• 404 — unknown ecosystem, release or identifier; the body explains the expected format.
• 429 — too many requests. The API allows about 60 requests per minute per IP, with short bursts. Wait a minute and retry; in CI, scan the lockfile once instead of checking packages one by one.

Fair use applies — see the terms of use. Need more? Get in touch. Ready-made CI snippets are in the guide.